The present invention is directed to method and system for storing handwritten signatures in an electronic format, and in particular, to a method and system operatable on a plurality of platforms for verification of electronically stored handwritten signatures and related documents.
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or patent disclosure as it appears in the Patent and Trademark Office, patent file or records, but otherwise reserves all copyright rights whatsoever.
Many computer systems, both static and portable, have been designed so that a user may enter data by means of a pen and a digitizer. Software exists to translate handwriting into recognized standard text. Many applications exist that are capable of taking advantage of pen input. Pen input facilitates the use of computers by those unfamiliar with or unskilled in the use of computer keyboards. Moreover, the use of pen-based computers, and the storage and transport of information in digital form, realizes an important commercial benefitxe2x80x94the reduction or elimination of the use of paper.
Digitizers typically sample the position of the pen tip around one hundred times a second, and are sensitive to movements of one seventieth of an inch. They are thus capable of very accurately recording the movement of the human hand. Computer signature verification can exploit this by analyzing not only the visible shape of the signature but also dynamic aspects such as speed and rhythm.
Algorithms exist that can take pen-based input (such as a handwritten signature), determine the fundamental characteristics of the pen-based input, and represent the characteristics of the pen-based input in an electronic format. Algorithms also exist that can determine if handwritten signatures in electronic format are that of the same person. For example, see U.S. Pat. No. 5,109,426 (U.K. Application No. 90 24383.3), U.S. Pat. No. 4,495,644 and U.K. Application No. 1480066, all expressly incorporated by reference herein.
Signature verification can make a highly significant contribution to computer security, in that all other security mechanisms rely upon what a person knows (e.g., a password) or possesses (e.g., a physical key). By relying instead on an aspect of physical behavior which cannot be stolen or divulged, signature verification offers secure evidence as to the real identity of the user.
To date, signature verification has been employed mainly in the area of access security, with the object of verifying the identity of an individual before giving the user access to all or part of a computer system.
However, traditional signatures made on a piece of paper are used to witness intentions in such contexts as signing a contract or will, and as a shield against repudiation as when signing a money order.
There are many areas today where, despite the availability of computerized documents, it is necessary to rely upon paper because of the legal or cultural requirement for a signature.
Thus, it is often the case that a hardcopy of a document is preferred to that same document in a digital or electronic format. For example, a will or contract for the transfer of land is required by law in most jurisdictions to be in writing and to include original handwritten signatures of the parties and witnesses to the document. When a document is in electronic form, because it is relatively easy to manipulate the contents of the document, it is often uncertain if a document viewed at a later date is the same as the document originally created. Although handwritten signatures captured using pen input facilities can be incorporated in the text of such documents, one is never certain if a document viewed at a later date is the one that was xe2x80x9celectronicallyxe2x80x9d signed.
Accordingly, it would be desirable to apply the science of handwritten signature capture and verification to a much wider context than as a security access mechanism. In particular, there exists a need in the area of testifying to an intention (such as, for example, signing a legal document) for a secure signature capture and verification method that relates the document signed to the signature of the signer.
Existing systems have focused on whether an electronic version of a signature has been manipulated after it was created and whether an electronic version of a signature associated with an electronic document was captured at the time of a transaction to which it relates. For example, U.S. Pat. No. 5,195,133 to Kapp et al. describes a mechanism that attempts to assure that a signature purportedly approving a commercial obligation was captured at the time of a questioned transaction and is not a genuine signature obtained on some other occasion and fraudulently merged into the digital record of the transaction. The apparatus of the Kapp et al. patent creates a digital record of a transaction, captures a digital representation of a signature at the time of the transaction, and then uses the digital record of the transaction to encrypt the digital representation of the signature. This method aims to ensure that the representation of the signature was made when it is said it was made. However, such a system does not verify if the document that was signed using a digitally captured handwritten signature has been later modified. Moreover, systems such as the Kapp et al. system require a transaction, and are incapable of operation where a signature is to be captured and verified in an environment unrelated to a transaction.
Existing handwritten capture and verification systems are designed for use on a single platform. Often, the handwritten signature is encoded in such a way that other applications are not capable of utilizing the electronic form of the handwritten signature. By virtue of today""s advanced computer-to-computer communications, including communication over the Internet, many applications will not require that verification be performed upon the same machine or at the same time as the act of signing itself. For example, it would be desirable for a system to enable a handwritten signature to be captured electronically on one device, stored, electronically transmitted to another device on another computer platform, and later verified. Accordingly, there is a need for an integrated cross-platform signature verification system. In particular, there is a need for a system that does not presuppose any particular underlying hardware, and is designed to be portable across different types of computer and operating system.
Many businesses and government departments often require people to sign documents. For example, when buying goods by check or credit card, when signing a car rental agreement, when entering a lease, when applying for a driver""s license or other government permit, on election day, or to certify attendance at an examination. Often, the person requesting the signature does not know the individual who is required to sign, and does not have an authentic signature of the signer to compare with the requested signature. Moreover, even if an authentic signature is available for comparison, the person requesting the signature often is unskilled in determining whether two signatures are from the same person. Accordingly, there is a need for a system that allows a signature to be captured electronically in one location, electronically transmitted to a central location that has recorded verified signing behaviors of many individuals, and returns an indication of the identity of the signer.
In certain situations, a person who has signed a contract or other legal document will attempt to terminate his or her obligations by claiming at a later date that he or she did not understand the nature of the document being signed or that he or she was misled when signing the document. Moreover, in a multi-windowed computing environment, a person signing a document electronically may not be sure which document stored on the computer he or she is actually signing. It would be useful if a record was made at the time of signing (that could later be retrieved) that records what the signer was told when signing a document and, before signature, alerts the signer as to the identity, nature and gravity of the document being signed.
In short, there is a need for a system that takes advantage of the increasing availability of these pen-based input devices by enabling the application of handwritten signature capture and verification technology to be used in the diverse contexts where signature capture is needed.
The present invention provides an integrated method and system for the electronic capture of a handwritten signature, storage of the handwritten signature in electronic form, electronic transportation of the captured handwritten signature, and authentication of the captured handwritten signature.
When used herein, the term xe2x80x9csignaturexe2x80x9d means the handwritten mark made by a person that represents that person""s intent or assent. It includes what is usually regarded as a person""s autograph. The term xe2x80x9csignedxe2x80x9d has a corresponding meaning, and includes any symbol executed or adopted by a party with present intention to authenticate a writing, where such writing may be in an electronic format. It is noted that the term xe2x80x9csignaturexe2x80x9d as used herein does not include what has come to be known in computer science fields as a xe2x80x9cdigital signaturexe2x80x9d, i.e., an electronic code that is used to establish the identity of the person creating or sending an electronic document. A xe2x80x9cdigital signaturexe2x80x9d has the function of replacing a handwritten signature, with a secret alpha-numeric xe2x80x9ckeyxe2x80x9d supplied to a given individual, which then has to be kept secret. In contrast, the present invention is directed to electronically capturing and manipulating a person""s handwritten signature.
In the representative embodiment, the present invention utilizes known pen-based hardware to electronically capture handwritten signatures.
The representative embodiment of the present invention comprises a signature capture module, a signature verification module and a template database.
The signature capture module captures the signature of a person and creates a signature envelope representing (or recording) the act of signing. The signature envelope stores certain data associated with the manual inscription of a signature captured in electronic form, for example, on a computer screen of a pen-based computer. Typically, the signature capture module is called and controlled by, and communicates with, a client application.
For example, the client application may require a handwritten signature for a document. The client application calls the signature capture module, which will display on the screen a signature capture window and request that the user inscribe his or her signature (for example, using an electronic stylus) to this window on the computer""s screen. The client application may supply to the signature capture module an identification of the document being signed and/or the reason why (or importance of) the document being signed. This information, called a gravity prompt, can be displayed to the user by the signature capture module in the signature capture window. This allows the user to make sure that the document being signed is the one that the user believes he or she is signing, and moreover, alerts the user to reason for and the gravity of the act of signing.
As the user signs the document, (e.g., by moving the pen or stylus across the screen), an image appears that traces the movement of the stylus. Thus, the user""s signature (or autograph) is displayed to the user. At the time of signing, the signature capture module measures certain features of the act of signing, such as, for example, the size, shape and relative positioning of the curves, loops, lines, dots, crosses and other features of the signature being inscribed, as well as the relative speed at which feature is being imparted. These measurements can be termed xe2x80x9cact-of-signing measurements.xe2x80x9d
In the representative embodiment of the present invention, the signature capture module may create a checksum of the document that was signed. The document checksum can be used at a later date to verify that the document alleged to have been signed is the one that was signed, and further, that no change to that document has been made.
In the representative embodiment, the document checksum is not a complete statement of the original document, and the original document cannot be derived from the document checksum. The document checksum bears a mathematical relationship to the document. If the document is changed, then it can no longer be mathematically matched with the checksum.
In an alternative embodiment, a compressed representation of the document that was signed can be created in addition to, or as an alternative to, the document checksum.
The signature capture module encrypts data representing, inter alia, the act-of-signing statistics, the time and date of signing, the claimed identity of the signer, the words that appear in the gravity prompt, the document checksum, and optionally, data representing a graphic image of the signature. The signature capture module creates a signature envelope that comprises this encrypted data. In the representative embodiment, the signature envelope is an encrypted string of data. Accordingly, the signature envelope is a secure way to represent the inscription event.
According to the representative embodiment, the client application cannot decrypt or alter the information contained in the signature envelope.
The signature verification module reports the probability that a particular signature is authentic. The signature verification module has access to the template database. The template database stores a plurality of templates. Each template includes act-of-signing statistics for a person and the known identity of that person. Each template is created during a controlled enrollment process, and stored in the template database for later access.
In the representative embodiment, the signature verification module and template database may be located at a remote location, accessible-by many client applications. For example, the signature verification module and template database may be located at a central independent signature verification bureau. In an alternative embodiment, the signature verification module and template database are located upon the local system, accessible by the client application when necessary.
When a client application wishes to verify a signature, the client application passes the signature envelope representing the signature to be verified to the signature verification module. It is noted that each client application can have verified signatures that were created by that client application, or that were created at an earlier time by other client applications.
For example, the signature capture module may reside on many computers, such as, for example, a fleet of portable pen-based computers, while the signature verification module may reside on a single host computer. The portable computers might capture numerous signatures over time (and thereby create numerous signature envelopes) and transmit them to the host computer for verification.
When the signature verification module is presented with a particular signature envelope, it can be directed to evaluate whether the signature envelope is a product of an authentic inscription of the signature belonging to the user identified in the signature envelope. The signature verification module can decrypt the signature envelope and compare the information therein with the signature templates stored in the template database. Based on this comparison, the signature verification module can determine a signature match percentage (e.g., 78%) and report this, and other information stored in the signature envelope, to the client application.
Accordingly, the present invention enables electronically captured handwritten signatures to be used in the same contexts as traditional paper signatures. Signatures captured according to the present invention will exceed the xe2x80x9cperformancexe2x80x9d of traditional signatures by using computer technology to assist in the detection and prevention of forgery and fraud.
The present invention is designed for use in conjunction with existing software programs, for example, as a software component to be activated by other computer programs. The present invention can be used as part of a security program to allow a user access to a computer network, as part of a word processing program, or as part of an e-mail program (e.g., to verify the identity of a sender of an e-mail message). The present invention takes care of the processing which specifically relates to signature capture and verification. (As used herein, the programs making use of the services of the modules of the present invention are termed xe2x80x9cclient programsxe2x80x9d.)
Thus, client programs may use the present invention to capture signatures for all kinds of purposes. The present invention enables the traditional manner of indicating agreement (a handwritten signature) to be carried forward into new technological environments, while avoiding the need for paper. For example, the signature capture module of the present invention might be made to reside in a cable television converter unit (sometimes called a xe2x80x9cset-top boxxe2x80x9d) that is fitted with a digitizer, so that a viewer can authorize the supply of various goods and services using the present invention. Signatures so captured would be transmitted back down the line to the provider""s system where they can be submitted to a signature verification module prior to delivery, and then archived as a record of the event. An advantage of this method is that the members of a household can be individuated (for example, parent, child, etc.) without requiring them to carry and secure personal cards, or furnishing them with xe2x80x9csecretxe2x80x9d numbers and the like. The present invention can easily be enhanced by implementing the signature capture module within a handheld remote control unit fitted with a suitable touch-sensitive digitizer, for example, an its reverse side.
Another example is in applying for a loan to purchase a vehicle while at a car dealership. A handwritten signature could be captured by the signature capture module. The resulting signature envelope could then be submitted to an independent signature verification bureau. The verification score returned could then be figured into the overall credit assessment before the applicant is allowed possession of a vehicle,
Signatures may also be captured where subsequent verification is either not required or even possible where a signature provided by an individual to a signature recipient is the first sample. Examples include a marriage license affidavit signed by both bride and groom, a hotel register signed by a guest, and a parcel delivery note signed by the recipient.
Thus, for example, a signature can be transmitted to a remote site for verification before allowing access to the remote computer system ; or a signature may simply be stored in a computer archive as a record that a particular person approved a particular document or transaction; or it may be desirable to verify a signature immediately in order to decide whether to allow the user access to a particular electronic document. To this end, the present invention provides extensive functionality to the client program.
The present invention does not allow signature data (especially, the signature envelope) to become subject to fraudulent misuse. Client programs can not access signature data except in encrypted form, nor can they obtain information which would be of material assistance to a prospective forger.
A unique security feature of the present invention is that rather than transmitting the raw signature data to the verifier (i.e., rather than allowing the signature capture module to transmit raw signature data to the signature verification module), feature extraction is carried-out at completion of capture. The raw signature data is, in the representative embodiment, not stored in the signature envelope nor made available at any stage to the client program. This makes it impossible to recreate raw signature data through the examination of the signature envelope and subsequently to re-inject the raw signature data into the system. This also reduces the amount of information to be transmitted or archived prior to verification.
The present invention can be used to assist in the detection of unauthorized modification of electronic documents. As stated above, a document checksum is calculated from the character codes making up the document, and stored away from that document as part of the signature envelope. The document checksum obtained from a modified document would be different, and thus the modification can be detected. The present invention uses an advanced checksumming method to bind signature envelopes to documents in support of a complete electronic metaphor for ink drying on paper. Together with the gravity prompt, this assists in maintaining a single intended use for each act of signing, such that a signature submitted on one document cannot be used on another.